CVE-2026-110310: CWE-204 Observable response discrepancy in Amazon Amazon.Extensions.S3.Encryption

This vulnerability arises from an observable response discrepancy (CWE-204) in Amazon.Extensions.S3.Encryption that allows an attacker who can read encrypted objects in an S3 bucket to downgrade the padding scheme to legacy PKCS#1 v1.5 by altering the object's metadata. Because PKCS#1 v1.5 is vulnerable to the Bleichenbacher attack, the attacker can use a padding oracle to recover the RSA-wrapped envelope key, thereby decrypting the encrypted object. The affected versions include 2.1.0, all versions from 3.0.0 up to and including 3.2.1, and 4.0.0 up to and including 4.0.2. AWS has released fixed versions 3.2.2 and 4.0.3. The vulnerability has a CVSS 3.1 score of 5.3, indicating medium severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact.

An attacker with read access to encrypted S3 objects can exploit this vulnerability to decrypt those objects by recovering the RSA-wrapped envelope key through a Bleichenbacher padding oracle attack. This compromises the confidentiality of the encrypted data. There is no impact on integrity or availability. No known exploits are reported in the wild.

AWS recommends upgrading affected versions to 3.2.2 or 4.0.3 where this vulnerability is fixed. Versions 1.x and 2.x lines will not be patched, so users on those versions must migrate to the fixed versions. Since this is a cloud service, AWS manages the underlying service security, but users must update their client libraries accordingly. Patch status is confirmed by the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-135-aws/.